Unrated
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, wh...
CVE-2021-29922
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2021-29922 rust Fixed in: 1.52.1-r1
- Debian DEBIAN-CVE-2021-29922 rustc Fixed in: 1.53.0+dfsg1-1
Original description The description as published by the source.
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.
References
- advisory defcon.org
- advisory doc.rust-lang.org
- advisory security.gentoo.org
- patch github.com
- patch github.com
- report github.com